Privacy law change

The consumer group's case was based on the country's Federal Data Protection Act, which says that in order to gain consent, tech firms must be clear about the nature, scope and purpose of the way they use customers' data.

The court agreed that Facebook had not done enough to alert people to the fact that it had pre-ticked several privacy settings.

These included an option to share their location with the person they were chatting to, and agreement that Google and other sites could show links to their profiles in search results.

In addition, the court ruled that a requirement that users provide their real names was unlawful.

It also decided that the social network needed to gain more explicit consent before it could use members' names and profile pictures in commercial and sponsored materials.

Vzbv said the social network would require "users' informed consent" in the future as a consequence.

New law imminent

The dispute dates back to 2015, and Facebook suggested the verdict had already been overtaken by events.

"We are reviewing this recent decision carefully and are pleased that the court agreed with us on a number of issues," it said in a statement.

"Our products and policies have changed a lot since this case was brought, and further changes to our terms and data policy are anticipated later this year in light of upcoming changes to the law," it added, referring to the EU's forthcoming General Data Protection Regulation (GDPR).

"Regardless of this case and the subsequent appeal, we will likely see a shift away from these things anyway with the forthcoming GDPR, which comes into force on 25 May," said Anita Bapat, a data protection expert at the law firm Kemp Little

"The new law emphasises the need to provide consumers information about how their data will be used in a consumer-friendly way and to obtain genuine consent.

"It is a law which is forcing all companies, ranging from Facebook to start-ups, to address their data uses," she added.